How to Report Phishing in Outlook (Every Version)

How to report phishing in Outlook step by step: new and classic Outlook, Outlook.com, Mac, mobile and Microsoft 365 work accounts, plus Gmail and next steps.

Here is how to report phishing in Outlook: select the suspicious message, choose Report in the toolbar or ribbon, then Report phishing. In the Outlook mobile app, tap the three-dot menu, choose Report Junk and then Phishing. With a work or school account, the report may go to your organization's security team as well as Microsoft.

The exact location of the button depends on which Outlook you use. Below are step-by-step instructions for every current version, plus how to report phishing in Gmail and what to do if you already clicked a link.

Report phishing vs. Report junk

Outlook offers both options, and choosing the right one helps Microsoft's filters learn:

• Report junk is for unwanted email such as spam newsletters and unsolicited advertising.
• Report phishing is for messages that try to trick you: fake login requests, fake invoices, impersonated colleagues or companies, links to fake websites and requests for passwords, payment or personal data.

If a message pretends to be someone it is not and wants you to act, it is phishing. Not sure? Our guides on how to spot a phishing email and checking if an email is legit can help.

How to report phishing in Outlook on the web and new Outlook

The new Outlook for Windows and Outlook on the web (Outlook.com) share the same layout. Microsoft's article Phishing and suspicious behavior in Outlook describes these steps:

1. In the message list, select the message (or several messages) you want to report.
2. Above the reading pane, select Report.
3. Select Report phishing.

Reporting does not block the sender. To stop future messages, add the address to your blocked senders list as well.

Classic Outlook for Windows

Current versions of classic Outlook for Microsoft 365 include a built-in Report button:

1. Select the suspicious message in your inbox.
2. On the Home tab of the ribbon, select Report.
3. Select Report phishing (or Report junk for ordinary spam).

If you use the Simplified Ribbon and do not see the button, open the overflow menu (the three dots at the end of the ribbon). On some organization-managed computers you may see an older Report Message button instead. Microsoft says the Report Message and Report Phishing add-ins are in maintenance mode and recommends the built-in Report button, as explained in its add-in transition guidance.

Outlook for Mac

Microsoft lists the built-in Report button for Outlook for Mac version 16.89 and later:

1. Select the message in the message list.
2. In the toolbar, select Report.
3. Select Report phishing.

If you do not see the button, update Outlook. If it is a work Mac, your organization may use a different reporting button.

Outlook mobile (iPhone, iPad and Android)

Microsoft's article How do I report phishing or junk email? gives these steps for Outlook for iOS and Android:

1. Open the email you want to report.
2. Tap the three-dot menu at the top right of the screen.
3. Choose Report Junk.
4. Select Phishing. You can also choose Junk or Block Sender.

Labels can vary slightly between app versions and account types, so look for a Report option in the same menu if you do not see Report Junk.

Microsoft 365 work or school accounts

With a work or school account, reporting is controlled by your administrator. According to Microsoft's admin documentation:

• The built-in Report button appears only if your organization has turned on user reporting and selected it. Some organizations use a security vendor's button instead.
• Reported messages go to a reporting mailbox, to Microsoft, or both. In practice, your security team often sees what you report.
• Messages reported as phishing are deleted from your mailbox.
• Messages reported as junk move to the Junk Email folder, and the sender is added to your Blocked Senders list.
• If a real message lands in Junk, select it, choose Report, then Not junk.

If you cannot find any report option, forward the message to your IT or security team the way your organization asks. Targeted attacks on employees are common, as our guide to spear phishing explains.

How to report phishing in Gmail

Google's Gmail phishing help page gives these steps for a computer:

1. Open Gmail in a web browser.
2. Open the suspicious message.
3. Next to Reply, click More (the three dots).
4. Click Report phishing.

In the Gmail app for Android, iPhone and iPad, Google's spam help page documents opening the email, tapping More at the top right and choosing Report spam. For a full phishing report, use Gmail on a computer.

Report it outside your inbox too

Your email provider's button protects your mailbox. National services use reports to warn and protect everyone else:

• United States: forward phishing emails to reportphishing@apwg.org, as the FTC recommends.
• United Kingdom: forward suspicious emails to report@phishing.gov.uk.

If the email links to a fake website, report the site as well. See how to report a scam website and our country-by-country guide on how to report a scam.

What happens after you report

For personal accounts, reports help Microsoft and Google improve their filters so similar messages are caught for you and other users. You will not normally receive a reply. For work accounts, your security team may review the message, remove it from other mailboxes and warn colleagues. If a domain is spoofing your company, our guide to SPF, DKIM and DMARC shows how to make that harder.

What to do if you already clicked

1. Stop. Do not enter any more information and close the page.
2. Change your password if you typed it in. Go to the real site directly, not through the email, and change it anywhere you reused it.
3. Turn on two-step verification for your email and other important accounts.
4. Check your account settings. Microsoft's guide to recovering a hacked or compromised Microsoft account recommends a full antivirus scan and reviewing settings such as forwarding and automatic replies.
5. Call your bank if you entered card or banking details.
6. Tell your IT team immediately if it was a work account. Speed matters more than embarrassment.

If a phishing email led to a fake page copying your brand, you can report a phishing site to Phishvoid. Brand owners can also book a free exposure scan to find lookalike domains before customers do.

FAQ

Where is the Report button in Outlook?

In new Outlook and Outlook on the web, it is above the reading pane. In classic Outlook for Windows, it is on the Home tab (or in the overflow menu on the Simplified Ribbon). On mobile, it is in the three-dot menu as Report Junk.

Does reporting phishing block the sender?

Not on Outlook.com. Microsoft notes that reporting does not block the sender, so add them to your blocked senders list. On work accounts, reporting junk adds the sender to Blocked Senders.

Should I report phishing or just delete it?

Report it. Deleting protects only you, while reporting helps filters catch the same campaign for others. Reporting phishing on a work account also deletes the message.

Why can't I see Report phishing in my work Outlook?

Your administrator may have turned off user reporting or chosen a third-party reporting button. Ask your IT team how they want suspicious emails reported.

What if I reported a real email by mistake?

If it went to Junk, select it, choose Report and then Not junk. If you reported it as phishing on a work account, ask your IT team to check it.